Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40

Multiple PHP Vulnerabilities Enable Denial of Service, TLS (TL-2026-2658), also tracked as GovCERT.HK A26-09-40, is a medium-severity software vulnerability scored CVSS 7.5, first published 2026-09-25. It has no confirmed attribution, affects PHP Group PHP, references 11 CVEs (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103), maps to 10 MITRE ATT&CK techniques (T1190, T1212, T1499.004), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-2658

Threat ID
TL-2026-2658
Also known as
GovCERT.HK A26-09-40
Severity
MEDIUM
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-25
Last reviewed
2026-09-25
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, technology, finance, ecommerce, web-hosting, education
Target regions
hong kong, Global
Detection rules
9
Indicators of compromise
14

Malware and tooling in Multiple PHP Vulnerabilities Enable Denial of Service, TLS

Malware and tooling: PHP, PharData, SoapServer

GovCERT.HK Security Alert A26-09-40 (25 Sep 2026) covers 11 CVEs fixed in PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34, spanning the SOAP, OpenSSL, PHP-FPM, Phar, Standard, and MySQLnd components. Impacts include unauthenticated remote denial of service via unbounded XML recursion in SoapServer, an IPv6 FastCGI ACL bypass, a TLS certificate-verification bypass, and cross-origin credential leakage on HTTP redirects. No CVE is listed in the CISA KEV catalog and no public proof-of-concept exploit has been confirmed for any of them as of disclosure.

How Multiple PHP Vulnerabilities Enable Denial of Service, TLS works

On 22-24 September 2026 the PHP Foundation shipped four coordinated security releases — PHP 8.2.34 and 8.3.35 (security-only) and PHP 8.4.26 and 8.5.11 (bug-fix + security) — closing out a set of 11 CVEs across six components. GovCERT.HK published Security Alert A26-09-40 on 25 September 2026 summarizing the bundle at its own 'Security Alert' (not 'High Threat Security Alert') tier, i.e. medium severity by their classification convention, with the stated cross-cutting impact framed as denial of service. NVD's per-CVE records, however, show the bundle also carries information-disclosure and authentication-bypass consequences beyond DoS.

The highest-severity issue, CVE-2026-91765 (CVSS 7.5), is an unbounded-recursion flaw in the SOAP extension: cleanup_xml_node() in the XML parser recurses once per nesting level with no depth limit, so an unauthenticated attacker can POST a SOAP request with tens of thousands of nested elements to any SoapServer endpoint, exhaust the call stack, and crash the worker process; the same unbounded-recursion pattern also exists in the SOAP value decoder and the WSDL node-search helper per the GHSA-rgrp-mwpx-f6rm write-up.

A second cluster affects OpenSSL/TLS client verification. CVE-2026-91767 is a heap buffer over-read in php_openssl_matches_wildcard_name() (ext/openssl/xp_ssl.c): a length argument passed to memchr() underflows when a malicious server presents a wildcard certificate name longer than the hostname being verified, letting the server force the client to read past a heap allocation. CVE-2026-91769 is a logic flaw where PHP's peer-verification code checks a certificate's subjectAltName entries and, when none match, incorrectly falls back to the Common Name — violating RFC 6125, which requires the CN to be ignored once any subjectAltName is present — so a certificate with a non-matching SAN but a matching CN is still accepted. Both are reachable by default because PHP enables peer-name verification automatically on outbound TLS client streams.

A third issue, CVE-2026-91768, is an access-control bypass in PHP-FPM: the IPv6 branch of the FastCGI client-address check compares only the first 12 of 16 address bytes, so listen.allowed_clients effectively matches on a /96 prefix rather than the full address, letting any attacker who can source a request from a matching /96 network reach an endpoint that was meant to be restricted.

A fourth cluster covers the Standard extension's HTTP stream wrapper: CVE-2026-91766 forwards Authorization, Cookie, and Proxy-Authorization headers unchanged when the wrapper follows a redirect, even across a different host, port, or an HTTPS-to-HTTP downgrade, allowing a malicious or compromised redirect target to capture credentials meant for the original origin; CVE-2026-93682 is a one-byte heap over-read when a redirect response carries an empty Location header, letting a malicious server influence where the read runs off into and where the client's dereferenced redirect target ends up; and CVE-2026-92842 is a heap-memory disclosure in the convert.base64-encode / convert.quoted-printable-encode / convert.quoted-printable-decode stream filters, where the constructor's line-break-chars option tracks length separately from the string and mishandles embedded NUL bytes, disclosing adjacent heap memory in filtered output.

Rounding out the set: CVE-2026-6103 is an integer overflow in Phar's phar_tar_number(), which parses an 11-digit octal TAR size field into an unchecked uint32_t so a size above 0xFFFFFFFF silently wraps, letting a crafted TAR archive smuggle entries that PharData extracts as if legitimate; CVE-2026-17545 is PHP's failure on Windows to reject reserved device names (CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, CONOUT$) as path components in filesystem/stream functions, so an attacker-supplied filename can open a character device and hang a worker thread; CVE-2025-14181 is a SOAP HTTP client integer-overflow-to-buffer-overflow, where a buffer-growth check relies on undefined-behavior signed-integer overflow that a compiler may optimize away, letting a malicious SOAP server make the client allocate an undersized buffer it then overflows; and CVE-2025-1218 is a set of packet over-reads in the mysqlnd wire-protocol parser, which reads fixed-width fields out of server packets before confirming enough bytes remain, so a malicious or compromised MySQL server can send a truncated packet and crash the client.

None of the 11 CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of 25 September 2026, and third-party exploit trackers (TheHackerWire) report no confirmed public proof-of-concept for the two highest-severity issues (CVE-2026-91765, CVE-2026-91768) at disclosure. All 11 require either an attacker-controlled/compromised counterparty server (MySQL, SOAP, HTTP/TLS) or direct network reachability to a PHP-FPM/SOAP endpoint — none is exploitable purely client-side without such a position.

MITRE ATT&CK techniques used in TL-2026-2658

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Impact

T1499.004 Application or System Exploitation

Resource Development

T1583.004 Server; T1588.006 Vulnerabilities

Reconnaissance

T1590.005 IP Addresses; T1592.002 Software; T1595.002 Vulnerability Scanning

Affected products and versions in Multiple PHP Vulnerabilities Enable Denial of Service, TLS

  • PHP Group — PHP
    Vulnerable versions: 8.5.0-8.5.10
    Fixed in: 8.5.11
  • PHP Group — PHP
    Vulnerable versions: 8.4.0-8.4.25
    Fixed in: 8.4.26
  • PHP Group — PHP
    Vulnerable versions: 8.3.0-8.3.34
    Fixed in: 8.3.35
  • PHP Group — PHP
    Vulnerable versions: 8.2.0-8.2.33
    Fixed in: 8.2.34

Remediation for Multiple PHP Vulnerabilities Enable Denial of Service, TLS

Patches

  • PHP 8.5.11
  • PHP 8.4.26
  • PHP 8.3.35
  • PHP 8.2.34

Immediate actions

  • Upgrade all PHP installations to 8.5.11, 8.4.26, 8.3.35, or 8.2.34 (or later within the same branch) immediately
  • Restart php-fpm, Apache mod_php, and any long-running PHP CLI worker processes after upgrading so the patched binary is actually loaded
  • Audit PHP-FPM listen.allowed_clients ACL rules that rely on IPv6 prefixes; treat IPv6-based allowlisting as unreliable until patched (CVE-2026-91768)
  • Review outbound HTTP client code (file_get_contents(), stream_context, SOAP/HTTP clients) for redirect-following behavior toward untrusted or third-party hosts (CVE-2026-91766, CVE-2026-93682)

Workarounds

  • Where immediate upgrade is not possible, restrict PHP-FPM FastCGI listener exposure to trusted IPv4 ranges only and disable IPv6-based ACL entries (mitigates CVE-2026-91768)
  • Firewall SOAP endpoints off from untrusted networks until patched (mitigates CVE-2026-91765)
  • Strip or refuse to forward Authorization/Cookie/Proxy-Authorization headers in application code that manually follows HTTP redirects (mitigates CVE-2026-91766)

Longer-term hardening

  • Restrict public exposure of SoapServer endpoints that do not need to be internet-facing to reduce the blast radius of CVE-2026-91765
  • For high-value outbound TLS connections, do not rely solely on hostname/CN matching for peer verification; consider certificate pinning or explicit SAN allowlists
  • Adopt automated PHP version/patch tracking (OS package security channels, Renovate/Dependabot equivalents) to shorten time-to-patch on future PHP security releases
  • Validate user-supplied filenames on Windows PHP deployments against the reserved device name list (CON, PRN, AUX, NUL, COM1-9, LPT1-9, CONIN$, CONOUT$) before passing them to filesystem/stream functions

CVEs associated with Multiple PHP Vulnerabilities Enable Denial of Service, TLS

CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682

Weaknesses (CWE) in Multiple PHP Vulnerabilities Enable Denial of Service, TLS

CWE-674, CWE-122, CWE-125, CWE-190, CWE-297, CWE-200, CWE-522, CWE-1023, CWE-67

Timeline of Multiple PHP Vulnerabilities Enable Denial of Service, TLS

  • PHP 8.3.35, a security-only release, is published alongside 8.2.34 with the same 11 fixes.
  • PHP 8.2.34, a security-only release, is published by the PHP Foundation, backporting fixes for all 11 vulnerabilities to the oldest actively supported branch.
  • PHP 8.4.26 and PHP 8.5.11 are released, bundling the same 11 security fixes together with general bug fixes for DOM, generators, GD, Intl, and grapheme handling.
  • Cross-reference against the CISA Known Exploited Vulnerabilities catalog (1,726 entries as of this date) finds none of the 11 PHP CVEs listed, indicating no confirmed active exploitation.
  • Third-party exploit tracker TheHackerWire reports no confirmed public proof-of-concept exploit code for CVE-2026-91765 or CVE-2026-91768 as of initial disclosure.
  • GovCERT.HK issues Security Alert A26-09-40, 'Multiple Vulnerabilities in PHP,' classifying the bundle at its standard 'Security Alert' tier (not 'High Threat Security Alert') and urging immediate patching.
  • GitHub Security Advisories are published for each CVE (e.g. GHSA-rgrp-mwpx-f6rm for CVE-2026-91765, GHSA-62xp-839h-2637 for CVE-2026-91768, GHSA-xr7j-rvgx-xq5p for CVE-2026-91767) with root-cause technical write-ups.
  • NVD publishes CVE records for the nine 2026-series vulnerabilities (CVE-2026-6103, -17545, -91765 through -91769, -92842, -93682) with CVSS v3.1 base scores ranging 4.3-7.5.

Sources cited for Multiple PHP Vulnerabilities Enable Denial of Service, TLS

More in vulnerability

Detection coverage for TL-2026-2658

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2658 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats